Cloud Platform
Contact us
Asset Management
Vulnerability & Configuration Management
Risk Remediation
Threat Detection & Response
  • Overview
  • Platform Apps

  • Qualys Endpoint Security

    Advanced endpoint threat protection, improved threat context, and alert prioritization

  • Context XDR

    Extend detection and response beyond the endpoint to the enterprise

Compliance
Cloud Security

Microsoft security alert.

February 14, 2023

Advisory overview

Qualys Vulnerability R&D Lab has released new vulnerability checks in the Enterprise TruRisk Platform to protect organizations against 71 vulnerabilities that were fixed in 14 bulletins announced today by Microsoft. Customers can immediately audit their networks for these and other new vulnerabilities by accessing their Qualys subscription. Visit Qualys Security Blog to prioritize remediation.

Non-Qualys customers can audit their network for these and other vulnerabilities by signing up for a Qualys Free Trial, or by trying Qualys Community Edition.

Vulnerability details

Microsoft has released 14 security bulletins to fix newly discovered flaws in their software. Qualys has released the following checks for these new vulnerabilities:

  • Microsoft Office Security Update for February 2023

    Severity
    Critical 4
    Qualys ID
    110426
    Vendor Reference
    KB5002309, KB5002313, KB5002316, KB5002323
    CVE Reference
    CVE-2023-21714, CVE-2023-21715, CVE-2023-21716, CVE-2023-21721, CVE-2023-21823
    CVSS Scores
    Base 10 / Temporal 8.3
    Description
    Microsoft has released February 2023 security updates to fix multiple security vulnerabilities.

    This security update contains the following:

    Office Click-2-Run and Office 365 Release Notes
    Release notes for Office for Mac
    KB5002316
    KB5002309
    KB5002313

    QID Detection Logic:
    This authenticated QID checks the file versions from the Microsoft advisory with the versions on the affected office system.

    Note: Office click-2-run and Office 365 installations need to be updated manually or need to be set to automatic update. There is no direct download for the patch.

    Following keys are used in the detection. HKLM\SOFTWARE\Microsoft\Office\15.0\Common\InstallRoot\Path HKLM\SOFTWARE\Wow6432Node\Microsoft\Office\15.0\Common\InstallRoot\Path HKLM\SOFTWARE\Wow6432Node\Microsoft\Office\16.0\Common\InstallRoot\Path HKLM\SYSTEM\CurrentControlSet\Services\WACSM\ImagePath HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Office15.WacSERVER\InstallLocation HKLM\SOFTWARE\Microsoft\Office\ClickToRun\Configuration\InstallationPath HKLM\SOFTWARE\Wow6432Node\Microsoft\Office\ClickToRun\Configuration\InstallationPath

    Consequence
    Successful exploitation allows an attacker to execute code remotely.

    Solution
    Office Click-2-Run and Office 365 Release Notes
    Release notes for Office for Mac
    KB5002316
    KB5002309
    KB5002313

    Patches:
    The following are links for downloading patches to fix these vulnerabilities:
    Microsoft office February 2023

  • Microsoft SharePoint Server and Foundation Update for February 2023

    Severity
    Critical 4
    Qualys ID
    110427
    Vendor Reference
    KB5002312, KB5002325, KB5002330, KB5002342, KB5002346, KB5002347, KB5002350, KB5002352, KB5002353
    CVE Reference
    CVE-2023-21716, CVE-2023-21717
    CVSS Scores
    Base 10 / Temporal 8.3
    Description
    Microsoft has released February 2023 security updates to fix multiple security vulnerabilities.

    This security update contains the following KBs:

    KB5002347
    KB5002312
    KB5002353
    KB5002342
    KB5002330
    KB5002346
    KB5002350
    KB5002325
    KB5002352
    QID Detection Logic:
    This authenticated QID checks the file versions from above Microsoft KB article with the versions on affected SharePoint system.

    Consequence
    Successful exploitation allows an attacker to execute code remotely.

    Solution
    Refer to Microsoft Security Guidance for more details pertaining to this vulnerability.

    KB5002347
    KB5002312
    KB5002353
    KB5002342
    KB5002330
    KB5002346
    KB5002350
    KB5002325
    KB5002352

    Patches:
    The following are links for downloading patches to fix these vulnerabilities:
    February 2023

  • Microsoft Exchange Server Remote Code Execution (RCE) Vulnerability for February 2023

    Severity
    Critical 4
    Qualys ID
    50125
    Vendor Reference
    CVE-2023-21529, CVE-2023-21706, CVE-2023-21707, CVE-2023-21710
    CVE Reference
    CVE-2023-21529, CVE-2023-21706, CVE-2023-21707, CVE-2023-21710
    CVSS Scores
    Base 8.3 / Temporal 6.5
    Description
    Microsoft Exchange Server 2013, 2016 and 2019 are affected by multiple vulnerabilities.

    KB Articles associated with this update are: KB5023038

    Affected Versions:
    Microsoft Exchange Server 2013 Cumulative Update 23
    Microsoft Exchange Server 2016 Cumulative Update 23
    Microsoft Exchange Server 2019 Cumulative Update 11
    Microsoft Exchange Server 2019 Cumulative Update 12

    QID Detection Logic (Authenticated):
    The QID checks for vulnerable version of Microsoft Exchange Server by checking the file version of Exsetup.exe.

    Consequence
    Successful exploitation of the vulnerability may allow remote code execution

    Solution
    Microsoft has released patch, customers are advised to refer to KB5023038 for information pertaining to this vulnerability.

    Patches:
    The following are links for downloading patches to fix these vulnerabilities:
    KB5023038

  • Microsoft 3D Builder Remote Code Execution (RCE) Vulnerability for February 2023

    Severity
    Critical 4
    Qualys ID
    91975
    Vendor Reference
    CVE-2023-23377, CVE-2023-23390
    CVE Reference
    CVE-2023-23377, CVE-2023-23390
    CVSS Scores
    Base 7.2 / Temporal 5.3
    Description
    3D Builder is an application to View, Create, and Personalize 3D objects.
    Microsoft has released a security update to 3D Builder Application to address a remote code execution vulnerability.

    Affected Versions:
    3D Builder Version prior to 20.0.3.0

    QID Detection Logic:
    This QID gets the version of 3D Builder by querying wmi class Win32_InstalledStoreProgram.

    Consequence
    An attacker can perform a Remote Code Execution Vulnerability on a vulnerable version of 3D Builder.

    Note: Even though the attack vector is local, Microsoft classified this as a Remote Code Execution Vulnerability because an attacker may exploit this through social engineering, convinces a victim to download and open a specially crafted file from a website which leads to a local attack on their computer.

    Solution
    Customers are advised to install latest version of Application from 3D Builder Application.

    Patches:
    The following are links for downloading patches to fix these vulnerabilities:
    3D Builder Application

  • Microsoft .NET Framework Security Update for February 2023

    Severity
    Serious 3
    Qualys ID
    91977
    Vendor Reference
    KB5022497, KB5022503, KB5022727, KB5022728, KB5022729, KB5022730, KB5022731, KB5022732, KB5022733, KB5022734, KB5022735, KB5022782, KB5022783, KB5022784, KB5022785, KB5022786, KB5022838, KB5022858
    CVE Reference
    CVE-2023-21722, CVE-2023-21808
    CVSS Scores
    Base 7.2 / Temporal 5.3
    Description
    A Denial of Service and Remote Code Execution Vulnerability exist in Microsoft .Net Framework.

    Following KBs are covered in this detection:
    KB5022838
    KB5022503
    KB5022729
    KB5022732
    KB5022784
    KB5022727
    KB5022782
    KB5022731
    KB5022783
    KB5022858
    KB5022734
    KB5022786
    KB5022497
    KB5022728
    KB5022730
    KB5022735
    KB5022733
    KB5022785

    This security update is rated Important for supported versions of Microsoft .NET Framework.

    .NET Framework 2.0, 3.0, 3.5, 3.5.1, 4.6.2, 4.7, 4.7.1, 4.7.2, 4.8, and 4.8.1

    QID Detection Logic (Authenticated):
    Checks for vulnerable file.version of ntoskrnl.exe or Mscorlib.dll or System.core.dll for the respective .Net Framework KBs

    Consequence
    Successful exploitation may allow a attacker to perform Denial of Service or Remote Code Execution Vulnerability.
    Solution
    Customers are advised to refer to CVE-2023-21722 and CVE-2023-21808 for more details pertaining to these vulnerabilities.

    Patches:
    The following are links for downloading patches to fix these vulnerabilities:
    CVE-2023-21722
    CVE-2023-21808

  • Microsoft Dynamics Security Update for February 2023

    Severity
    Serious 3
    Qualys ID
    91978
    Vendor Reference
    CVE-2023-21570, CVE-2023-21571, CVE-2023-21572, CVE-2023-21573, CVE-2023-21807
    CVE Reference
    CVE-2023-21570, CVE-2023-21571, CVE-2023-21572, CVE-2023-21573, CVE-2023-21807
    CVSS Scores
    Base 6.4 / Temporal 4.7
    Description
    Microsoft Dynamics contains the following vulnerabilities:
    Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability.

    Affected Software:
    Microsoft Dynamics 365 (on-premises) version 9.0
    Microsoft Dynamics 365 (on-premises) version 9.1

    QID Detection Logic:
    This QID detects vulnerable versions by checking if the version of Microsoft.Crm.Setup.Server.exe is lesser than the affected Versions:

    Consequence
    Any authenticated attacker could trigger this vulnerability. It does not require admin or other elevated privileges.
    Solution
    Customers are advised to refer to CVE-2023-21573,CVE-2023-21572, CVE-2023-21571, CVE-2023-21570, CVE-2023-21807,for more details pertaining to this vulnerability.

    Patches:
    The following are links for downloading patches to fix these vulnerabilities:
    CVE-2023-21570
    CVE-2023-21571
    CVE-2023-21572
    CVE-2023-21573
    CVE-2023-21807

  • Microsoft Windows Security Update for February 2023

    Severity
    Critical 4
    Qualys ID
    91979
    Vendor Reference
    KB5022834, KB5022836, KB5022838, KB5022840, KB5022842, KB5022845, KB5022858, KB5022894, KB5022895, KB5022899, KB5022903
    CVE Reference
    CVE-2023-21684, CVE-2023-21685, CVE-2023-21686, CVE-2023-21687, CVE-2023-21688, CVE-2023-21689, CVE-2023-21690, CVE-2023-21691, CVE-2023-21692, CVE-2023-21693, CVE-2023-21694, CVE-2023-21695, CVE-2023-21697, CVE-2023-21699, CVE-2023-21700, CVE-2023-21701, CVE-2023-21702, CVE-2023-21797, CVE-2023-21798, CVE-2023-21799, CVE-2023-21801, CVE-2023-21802, CVE-2023-21803, CVE-2023-21804, CVE-2023-21805, CVE-2023-21811, CVE-2023-21812, CVE-2023-21813, CVE-2023-21816, CVE-2023-21817, CVE-2023-21818, CVE-2023-21819, CVE-2023-21820, CVE-2023-21822, CVE-2023-21823, CVE-2023-23376
    CVSS Scores
    Base 7.2 / Temporal 6
    Description
    Microsoft Windows Security Update - Feburary 2023

    QID Detection Logic (Authenticated):
    Operating Systems: Windows Server 2012, Windows Server 2016, Windows 10, Windows 11, Windows Server 2022, Windows Server 2019

    The KB Articles associated with the update:
    The patch version is 6.3.9600.20815 for KB5022899
    The patch version is 6.3.9600.20815 for KB5022894
    The patch version is 6.2.9200.24111 for KB5022903
    The patch version is 6.2.9200.24111 for KB5022895
    The patch version is 10.0.14393.5717 for KB5022838
    The patch version is 10.0.10240.19747 for KB5022858
    The patch version is 10.0.19041.2604 for KB5022834
    The patch version is 10.0.22621.1265 for KB5022845
    The patch version is 10.0.22000.1574 for KB5022836
    The patch version is 10.0.20348.1547 for KB5022842
    The patch version is 10.0.17763.4010 for KB5022840

    This QID checks for the file version of ntoskrnl.exe.

    Consequence
    Successful exploit could compromise Confidentiality, Integrity and Availability

    Solution
    Please refer to the following KB Articles associated with the update:
    KB5022899
    KB5022894
    KB5022903
    KB5022895
    KB5022838
    KB5022858
    KB5022834
    KB5022845
    KB5022836
    KB5022842
    KB5022840

    Patches:
    The following are links for downloading patches to fix these vulnerabilities:
    KB5022834
    KB5022835
    KB5022836
    KB5022838
    KB5022840
    KB5022842
    KB5022845
    KB5022858
    KB5022894
    KB5022895
    KB5022899
    KB5022903

  • Microsoft Visual Studio Security Updates for February 2023

    Severity
    Critical 4
    Qualys ID
    91980
    Vendor Reference
    CVE-2023-21566, CVE-2023-21567, CVE-2023-21808, CVE-2023-21815, CVE-2023-23381, CVE-2023-41953
    CVE Reference
    CVE-2023-21566, CVE-2023-21567, CVE-2023-21808, CVE-2023-21815, CVE-2023-23381, CVE-2023-41953
    CVSS Scores
    Base 4.6 / Temporal 3.4
    Description

    Microsoft has released security Updates for Visual Studio which resolve Remote Code Execution, Denial of Service and Escalation of Priviledge Vulnerabilities.

    Affected Software:
    Microsoft Visual Studio 2022 version 17.4
    Microsoft Visual Studio 2022 version 17.2
    Microsoft Visual Studio 2022 version 17.0
    Microsoft Visual Studio 2019 version 16.11 (includes 16.0 - 16.10)
    Microsoft Visual Studio 2017 version 15.9 (includes 15.0 - 15.8)

    QID Detection Logic: Authenticated : Windows
    This QID detects vulnerable versions of Microsoft Visual Studio by checking the registry key "HKLM\SOFTWARE\Microsoft" and file "evenv.exe" to check the version of the Visual Studio.

    Consequence
    Vulnerable versions of Microsoft Visual Studio are prone to Remote Code Execution, Denial of Service and Escalation of Priviledge Vulnerabilities.
    Solution
    Customers are advised to refer to CVE-2023-21815 and CVE-2023-23381 and CVE-2023-21567 and CVE-2023-21566 and CVE-2023-21808 and CVE-2023-41953for more information pertaining to this vulnerability

    Patches:
    The following are links for downloading patches to fix these vulnerabilities:
    CVE-2023-21566
    CVE-2023-21567
    CVE-2023-21808
    CVE-2023-21815
    CVE-2023-23381
    CVE-2023-41953

  • Microsoft Dynamics Unified Service Desk Remote Code Execution (RCE) Vulnerability

    Severity
    Critical 4
    Qualys ID
    91981
    Vendor Reference
    CVE-2023-21778
    CVE Reference
    CVE-2023-21778
    CVSS Scores
    Base 9.3 / Temporal 6.9
    Description

    Unified Service Desk assists an agent to view the data stored in the Dynamic 365 Customer Engagement app in a holistic manner.

    CVE-2023-21778:Microsoft Dynamics Unified Service Desk Remote Code Execution Vulnerability.
    Affected Software:
    Microsoft Dynamics Unified Service Desk prior to 4.2.0.51.
    QID Detection Logic(Authenticated):
    This authenticated QID flags vulnerable systems by detecting Vulnerable versions for file UnifiedServiceDesk.exe.

    Consequence
    The attacker might be able to call victim's local files in the Resources directory and execute Windows commands that are outside of the Dynamics application.
    Solution
    Customers are advised to refer to CVE-2023-21778

    Patches:
    The following are links for downloading patches to fix these vulnerabilities:
    CVE-2023-21778

  • Microsoft Power BI Report Server Update for February 2023

    Severity
    Critical 4
    Qualys ID
    91982
    Vendor Reference
    CVE-2023-21806
    CVE Reference
    CVE-2023-21806
    CVSS Scores
    Base 6.4 / Temporal 4.7
    Description
    Power BI Report Server, available as part of Power BI Premium, enables on-premises web and mobile viewing of Power BI reports, plus the enterprise reporting capabilities of SQL Server Reporting Services.

    Affected Versions:
    Power BI Report Server (September 2022) - file version: 15.0.1110.135 Power BI Report Server (September 2022)- file version: 15.0.1110.120 Power BI Report Server (May 2022)- file version: 15.0.1108.297 QID Detection Logic:
    This authenticated QID detects vulnerable versions of RSHostingService.exe by fetching the service installed path from the HKLM\SYSTEM\CurrentControlSet\Services\PowerBIReportServer registry key.

    Consequence
    Successful exploitation can lead to spoofing vulnerability

    Solution
    Customers are advised to refer to CVE-2023-21806 for more information pertaining to this vulnerability.

    Patches:
    The following are links for downloading patches to fix these vulnerabilities:
    CVE-2023-21806

  • Microsoft SQL Server Remote Code Execution (RCE) Vulnerability for February 2023

    Severity
    Critical 4
    Qualys ID
    91983
    Vendor Reference
    CVE-2023-21528, CVE-2023-21568, CVE-2023-21704, CVE-2023-21705, CVE-2023-21713, CVE-2023-21718
    CVE Reference
    CVE-2023-21528, CVE-2023-21568, CVE-2023-21704, CVE-2023-21705, CVE-2023-21713, CVE-2023-21718, CVE-2023-23384
    CVSS Scores
    Base 6 / Temporal 4.4
    Description
    Microsoft SQL Server prone to Remote Code Execution Vulnerability. Affected Software:
    SQL Server 2022 RTM (GDR)
    SQL Server 2019 RTM (GDR,CU18)
    SQL Server 2017 RTM (GDR,CU31)
    SQL Server 2016 Service Pack 3(GDR)
    SQL Server 2014 Service Pack 3 (GDR, CU4)
    QID Detection Logic (Authenticated):
    Detection looks for Microsoft SQL Server instances and checks sqlservr.exe file version

    Consequence
    Successful exploitation could lead to remote code execution

    Solution
    Customers are advised to refer to KB5021522 KB5021124 KB5021126 KB5021045 KB5021127 KB5021037 KB5021129 KB5021125 KB5021128 for more details pertaining to this vulnerability.

    Patches:
    The following are links for downloading patches to fix these vulnerabilities:
    KB5021037
    KB5021045
    KB5021124
    KB5021125
    KB5021126
    KB5021127
    KB5021128
    KB5021129
    KB5021522

  • Microsoft Windows Server Privilege Escalation Vulnerability

    Severity
    Critical 4
    Qualys ID
    91984
    Vendor Reference
    KB5022872, KB5022874, KB5022890, KB5022893
    CVE Reference
    CVE-2023-21800
    CVSS Scores
    Base 10 / Temporal 7.8
    Description
    Microsoft Windows Server Security Update - Feburary 2023

    QID Detection Logic (Authenticated):
    Operating Systems: Windows Server 2008, Windows Server 2008 R2

    The KB Articles associated with the update:
    The patch version is 6.1.7601.26362 for KB5022872
    The patch version is 6.1.7601.26362 for KB5022874
    The patch version is 6.0.6003.21911 for KB5022890
    The patch version is 6.0.6003.21911 for KB5022893

    This QID checks for the file version of ntoskrnl.exe.

    Consequence
    Successful exploitation of this vulnerability may allow a low privileged attacker to execute code with elevated permissions.
    Solution
    Please refer to the following KB Articles associated with the update:
    KB5022872
    KB5022874
    KB5022890
    KB5022893

    Patches:
    The following are links for downloading patches to fix these vulnerabilities:
    KB5022872
    KB5022874
    KB5022890
    KB5022893

  • Azure DevOps Server Multiple Vulnerabilities for February 2023

    Severity
    Critical 4
    Qualys ID
    91985
    Vendor Reference
    CVE-2023-21553, CVE-2023-21564
    CVE Reference
    CVE-2023-21553, CVE-2023-21564
    CVSS Scores
    Base 9.3 / Temporal 6.9
    Description

    Azure DevOps Server is a Microsoft product that provides version control, reporting, requirements management, project management, automated builds, testing, and release management capabilities.
    CVE-2023-21564: Azure DevOps Server Cross-Site Scripting Vulnerability.
    CVE-2023-21553: Azure DevOps Server Remote Code Execution Vulnerability.

    Affected Software:
    Azure DevOps Server 2022.
    Azure DevOps Server 2020.1.2

    QID Detection Logic(Authenticated):
    This authenticated QID flags vulnerable systems by detecting Vulnerable versions for file Microsoft.TeamFoundation.Framework.Server.dll.

    Consequence
    Any authenticated attacker could trigger this vulnerability. It does not require admin or other elevated privileges.
    Solution
    Customers are advised to refer to CVE-2023-21564, CVE-2023-21553, for more details.

    Patches:
    The following are links for downloading patches to fix these vulnerabilities:
    CVE-2023-21553
    CVE-2023-21564

  • Microsoft .NET Security Update for February 2023

    Severity
    Critical 4
    Qualys ID
    91986
    Vendor Reference
    CVE-2023-21808
    CVE Reference
    CVE-2023-21808
    CVSS Scores
    Base 4.6 / Temporal 3.4
    Description
    Microsoft has released a security Update for .NET which resolves Remote Code Execution Vulnerability.
    This security update is rated Important for affected versions of .NET

    Affected versions:
    .NET 6.0 before version 6.0.14
    .NET 7.0 before version 7.0.3

    QID Detection Logic: Authenticated
    On Windows, this QID detects vulnerable versions of Microsoft .NET by checking the file version.
    On Linux, this QID detects vulnerable versions of Microsoft .NET by checking the .NET version present in "/usr/share/dotnet/shared/Microsoft.NETCore.App/" and "/root/shared/Microsoft.NETCore.App" folders.
    On Mac, this QID detects vulnerable versions of Microsoft .NET by checking the .NET version present in "/usr/share/dotnet/shared/Microsoft.NETCore.App/" folder.

    Consequence

    Vulnerable versions of Microsoft .NET are prone to Remote Code Execution Vulnerability.
    Solution
    Customers are advised to refer to CVE-2023-21808 for more details pertaining to this vulnerability.

    Patches:
    The following are links for downloading patches to fix these vulnerabilities:
    CVE-2023-21808

These new vulnerability checks are included in Qualys vulnerability signature 2.5.700-3. Each Qualys account is automatically updated with the latest vulnerability signatures as they become available. To view the vulnerability signature version in your account, from the Qualys Help menu, select the About tab.

Selective Scan Instructions Using Qualys

To perform a selective vulnerability scan, configure a scan profile to use the following options:

  1. Ensure access to TCP ports 135 and 139 are available.
  2. Enable Windows Authentication (specify Authentication Records).
  3. Enable the following Qualys IDs:
    • 110426
    • 110427
    • 50125
    • 91975
    • 91977
    • 91978
    • 91979
    • 91980
    • 91981
    • 91982
    • 91983
    • 91984
    • 91985
    • 91986
  4. If you would like the scan to return the Windows Hostname, also include QID 82044 and ensure access to UDP port 137 is available.
  5. If you would like to be notified if Qualys is unable to log on to a host (if Authentication fails), also include QID 105015.

In addition, prior to running a scan for these new vulnerabilities, you can estimate your exposure to these new threats by running the Risk Analysis Report, available from the Qualys Vulnerability Management Reports tab.

Access for Qualys Customers

Platforms and Platform Identification

Technical Support

For more information, customers may contact Qualys Technical Support.

About Qualys

The Enterprise TruRisk Platform and its integrated suite of security and compliance applications provides organizations of all sizes with a global view of their security and compliance solutions, while drastically reducing their total cost of ownership. Qualys solutions include: continuous monitoring, vulnerability management, policy compliance, PCI compliance, security assessment questionnaire, web application scanning, web application firewall, malware detection and SECURE Seal for security testing of web sites.